PT-2025-38242

CVE-2025-58766

Published

2025-09-17

Updated

2025-09-18

Description by

CVSS 3.1

9.0

Critical

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dyad versions prior to 0.20.0

Description Dyad is a local AI app builder susceptible to arbitrary code execution on users' systems. The issue affects the application’s preview window functionality and can bypass Docker container protections. An attacker can craft web content that automatically executes when the preview loads, potentially gaining control of the system.

Recommendations Update to Dyad version 0.20.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jackfromeast

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers